﻿
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<!-- saved from url=(0014)about:internet -->
<html xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:mssdk="winsdk" xmlns:script="urn:script" xmlns:build="urn:build" xmlns:MSHelp="http://msdn.microsoft.com/mshelp">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/>
<meta name="Description" content="When you write an analysis extension plug-in, you also write a metadata file that describes the situations for which you want your plug-in to be called. When the !analyze debugger command runs, it uses metadata files to determine which plug-ins to load."/>
<meta name="MSHAttr" content="PreferredSiteName:MSDN"/>
<meta name="MSHAttr" content="PreferredLib:/library/windows/hardware"/>
<title>Metadata Files for Analysis Extension Plug-ins</title>



<link rel="STYLESHEET" type="text/css" HREF="../common/backsdk4.css"/>





<style>
html,div { margin: 0; padding: 0;}

body {
	padding: 0px;
	margin: 0px;
	overflow: auto;
	height: 100%;
}

#winchm_template_button{
	float: right;
	width: 93px;
	top: 7px;
	position: relative;
	text-align: right;
	right: 5px;
	height: auto;
}

#winchm_template_top{
	padding: 0px;
	margin: 0px;
	border-bottom: 1px solid #9B9B9B;
	background-color: #B1CEFE;
}

#winchm_template_navigation{
	margin: 0px;
	padding-top: 7px;
	padding-left: 7px;
	padding-bottom: 3px;
	padding-right: 0px;
	font-size: 8.5pt;
	font-family: Arial, Helvetica, sans-serif;
	font-weight: normal;
	color: #585858;
}

#winchm_template_title{
	margin: 0px;
	padding-top: 4px;
	padding-left: 7px;
	padding-bottom: 7px;
	padding-right: 0px;
	font-size: 18px; 
	font-family: Verdana, Geneva, sans-serif;
	color: #363636;
}

#winchm_template_content{
	margin-top: 20px;
	margin-left: 15px;
	margin-bottom: 20px;
	margin-right: 15px;
	width: auto  !important;
	width: 100%;
}

#winchm_template_footer{
	border-width: 1px;
	border-color: #B1CEFE;
	border-top-style: solid;
	margin-top: 15px;
	margin-left: 15px;
	margin-bottom: 20px;
	margin-right: 15px;
	padding-top: 7px;
	padding-left: 0px;
	padding-bottom: 0px;
	padding-right: 0px;
	font-family: arial, helvetica, sans-serif;
	font-size: 8.5pt;
	color: #696969;
	width: auto;
	text-align: left;
}


#winchm_template_container{
	margin: 0px;
	padding: 0px;
	position: static;
	padding-bottom: 3px;
	overflow: auto;
	background-color: #FFFFFF;
}


@media print
{
#winchm_template_container{
	position: static;	
	margin: 0px;
	padding: 5px;
	
	width: auto;
	height: auto;
	overflow: auto;
}
#winchm_template_button{
visibility:hidden;
}
}

#winchm_template_navigation A:link	{text-decoration: none; color:#004080}
#winchm_template_navigation A:visited  {text-decoration: none; color: #004080}
#winchm_template_navigation A:active {text-decoration: none; color: #004080 }
#winchm_template_navigation A:hover {text-decoration: none;color: #0080FF}

A:link	{text-decoration: underline; color:#0033CC}
A:visited  {text-decoration: underline; color: #0033CC}
A:active {text-decoration: underline; color: #0033CC }
A:hover {text-decoration: underline;color: #FF0000;}
</style>
<script type="text/javascript">
function isMobile(){
Agent = window.navigator.userAgent;
if (Agent.indexOf("iPhone")>=1 || Agent.indexOf("iPad")>=1 || Agent.indexOf("iPod")>=1 || Agent.indexOf("Android")>=1){
return true;
}else{
return false;	
}

}
function d_onresize(){
if (window.navigator.userAgent.indexOf("MSIE")>=1){
document.getElementById('winchm_template_container').style.pixelWidth = document.body.offsetWidth - 3;
document.getElementById('winchm_template_container').style.pixelHeight = document.body.offsetHeight - document.getElementById('winchm_template_top').offsetHeight - 4;
}
document.getElementById('winchm_template_container').style.top = document.getElementById('winchm_template_top').offsetHeight + 'px';
}

function d_onbeforeprint(){
document.getElementById('winchm_template_container').style.width = 'auto';
document.getElementById('winchm_template_container').style.height = 'auto';
}

function d_onafterprint(){
d_onresize();
}

if(!isMobile()){

window.onload = d_onresize;
window.onresize = d_onresize;
window.onbeforeprint = d_onbeforeprint;
window.onafterprint = d_onafterprint;

document.write("<style>\n");
document.write("body {overflow: hidden;}\n");
document.write("#winchm_template_container {position: absolute;overflow: auto;top : 0px;right: 0px;bottom: 0px;left: 0px;}\n");
document.write("</style>\n");
}

</script>
</head>
<body><script language="JavaScript" type="text/JavaScript">
function syn(){
if(parent.nav.tree){
 if(parent.nav.tree.loaded){
  parent.nav.tree.selectNode(1136);
 }else{
  setTimeout("syn()",500);
}
  }else{
  setTimeout("syn()",500);
  }}
if(parent!=self){
  setTimeout("syn()",100);
}else{
  parent.location.href = "../../index.htm?page=debugger/metadata_files_for_analysis_extensions.htm";
}
originalOnload = window.onload;
if(originalOnload==null){
window.onload = function(){parent.contentLoaded = true;};
}else{
window.onload = function(){originalOnload();parent.contentLoaded = true;};
}
</script> 


<div id="winchm_template_top">
	<div id="winchm_template_button"><A href="writing_an_analysis_extension_to_extend__analyze.htm" title="Previous topic"><img id="winchm_template_prev" alt="Previous topic" src="../template2/btn_prev_n.gif" border="0"></a><A href="failure_analysis_entries.htm" title="Next topic"><img id="winchm_template_next" alt="Next topic" src="../template2/btn_next_n.gif" border="0"></a></div>
	<div id="winchm_template_navigation">Help &gt; 
<A href="introduction6.htm">Debugging Tools for Windows (WinDbg, KD, CDB, NTSD)</A> &gt; <A href="debugging_resources.htm">Debugging Resources</A> &gt; <A href="debugger_engine_and_extension_apis.htm">Debugger Engine and Extension APIs</A> &gt; <A href="writing_custom_analysis_debugger_extensions.htm">Writing Custom Analysis Debugger Extensions</A> &gt; </div>
	<div id="winchm_template_title">Metadata Files for Analysis Extension Plug-ins</div>
</div>
<div id="winchm_template_container">
	<div id="winchm_template_content"><div id="mainSection"><p>When you write an analysis extension plug-in, you also write a metadata file that describes the situations for which you want your plug-in to be called. When the <a href="#Bookmark2224"><b>!analyze</b></a> debugger command runs, it uses metadata files to determine which plug-ins to load.</p>
<p>Create a metadata file that has the same name as your analysis extension plug-in and an extension of .alz.  For example, if your analysis extension plug-in is named MyAnalyzer.dll, your metadata file must be named MyAnalyzer.alz. Place the metadata file in the same directory as your analysis extension plug-in. </p>
<p>A metadata file for an analysis extension plug-in is an ASCII text file that contains key-value pairs. Keys and values are separated by white space. A key can have any non-whitespace character. Keys are not case sensitive. </p>
<p>After the key and the following white space, the corresponding value begins. A value can have one of the following forms.</p>
<ul>
<li>
<p>Any set of characters to the end of the line. This form works for values that do not contain any newline characters.</p>
<div class="alert"><b>Important</b>  If the last value in the metadata file has a value of this form, the line must end with a newline character.</div>
<div> </div>
</li>
<li>
<p>Any set of characters between braces { }. The form works for values that contain newline characters.</p>
</li>
</ul>
<p>A line beginning with # is a comment and is ignored. Comments can start only where keys are expected.</p>
<p>You can use the following keys in a metadata file.</p>
<table>
<tr>
<th>Key</th>
<th>Description</th>
</tr>
<tr>
<td>PluginId</td>
<td>String - Identifies the plug-in.</td>
</tr>
<tr>
<td>DebuggeeClass</td>
<td>String - Possible values are “Kernel” and "User". Indicates that the plug-in is interested in analyzing only kernel-mode failures or only user-mode failures.</td>
</tr>
<tr>
<td>BugCheckCode</td>
<td>32-bit bug check code - Indicates that the plug-in is interested in analyzing this <a href="#Bookmark1592">bug check code</a>.  A single metadata file can specify multiple bug check codes.</td>
</tr>
<tr>
<td>ExceptionCode</td>
<td>32-bit exception code - Indicates that the plug-in is interested in analyzing this <a href="http://go.microsoft.com/fwlink/p?LinkID=282670">exception code</a>.  A single metadata file can specify multiple exception codes.</td>
</tr>
<tr>
<td>ExecutableName</td>
<td>String - Indicates that the plug-in is interested only in sessions where this is the running executable of the process to be analyzed.  A single metadata file can specify multiple executable names.</td>
</tr>
<tr>
<td>ImageName</td>
<td>String - Indicates that the plug-in is only interested only in sessions where the default analysis considers this image (dll, sys, or exe) to be at fault. The plug-in is invoked after analysis has determined which image is at fault. A single metadata file can specify multiple image names.</td>
</tr>
<tr>
<td>MaxTagCount</td>
<td>Integer - The maximum number of custom tags that the plug-in needs. Custom tags are tags other than the ones defined in extsfns.h.</td>
</tr>
</table>
<p> </p>
<h2><a id="Example_Metadata_Files"></a><a id="example_metadata_files"></a><a id="EXAMPLE_METADATA_FILES"></a>Example Metadata Files</h2>
<p>The following metadata file describes a plug-in that is interested in analyzing  bug check code 0xE2. (Recall that the last line must end with a newline character.)</p>
<pre class="syntax" xml:space="preserve"><code>PluginId      MyPlugin
DebuggeeClass Kernel
BugCheckCode  0xE2

</code></pre>
<p>The following metadata file describes a plug-in that is interested in analyzing bug checks 0x8, 0x9, and 0xA if MyDriver.sys is considered to be the module at fault.</p>
<pre class="syntax" xml:space="preserve"><code>PluginId      MyPlugin
DebuggeeClass Kernel
BugCheckCode  0x8
BugCheckCode  0x9
BugCheckCode  0xA
ImageName     MyDriver.sys

</code></pre>
<p>The following metadata file describes a plug-in that is interested in analyzing exception code 0xC0000005 if MyApp.exe is the running executable of the process being analyzed. Also, the plug-in might create as many as three custom tags.</p>
<pre class="syntax" xml:space="preserve"><code>PluginId        MyPlugin
DebuggeeClass   User
ExceptionCode   0xC0000005
ExecutableName  MyApp.exe

</code></pre>
<p>Debugging Tools for Windows has a sample that you can use to build a debugger extension module named dbgexts.dll. This extension module implements several debugger extension commands, but it can also serve as an analysis extension plug-in; that is, it exports an <a href="#Bookmark1138"><b>_EFN_Analyze</b></a> function. Here is a metadata file that describes  dbgexts.dll as an analysis extension plug-in.</p>
<pre class="syntax" xml:space="preserve"><code>PluginId      	PluginSample
DebuggeeClass 	User
ExceptionCode 	0xc0000005
ExecutableName  	cdb.exe
ExecutableName  	windbg.exe
#
# Custom tag descriptions 
#
TagDesc       	0xA0000000 	SAMPLE_PLUGIN_DEBUG_TEXT 	{Sample debug
help text from plug-in analysis}
#
</code></pre>
<h2><a id="related_topics"></a>Related topics</h2>
<dl>
<dt><a href="#Bookmark1135">Writing an Analysis Extension Plug-in to Extend !analyze</a></dt>
<dt><a href="#Bookmark1138"><b>_EFN_Analyze</b></a></dt>
<dt><a href="#Bookmark2224"><b>!analyze</b></a></dt></dl></div></div>	
	<div id="winchm_template_footer">Copyright &copy; 2019. All rights 
reserved. (To change the copyright info, just edit it in template.)</div>
</div>

</body>
</html>
